CISM · Question #362
Which of the following is the BEST metric to measure the efficiency of an information security program?
The correct answer is D. Percentage of systems with defined control baselines. The percentage of systems with defined control baselines directly measures how comprehensively the security program has been implemented across the organization. It reflects program maturity and coverage - core indicators of efficiency. Average mitigation cost (A) measures…
Question
Which of the following is the BEST metric to measure the efficiency of an information security program?
Options
- AAverage mitigation cost per identified risk
- BNumber of completed lessons learned activities
- CRatio of risk assessments to vulnerability scans over time
- DPercentage of systems with defined control baselines
How the community answered
(26 responses)- A4% (1)
- B12% (3)
- C4% (1)
- D81% (21)
Explanation
The percentage of systems with defined control baselines directly measures how comprehensively the security program has been implemented across the organization. It reflects program maturity and coverage - core indicators of efficiency. Average mitigation cost (A) measures spending, not efficiency. Number of lessons learned activities (B) measures a process step, not overall program effectiveness. The ratio of risk assessments to vulnerability scans (C) is a comparison of two activities but does not indicate whether controls are actually in place. A high percentage of systems with defined baselines shows the program is systematically governing and protecting assets.
Topics
Community Discussion
No community discussion yet for this question.